HanabalRust's ban system runs on Easy Anti-Cheat and groups bans into monthly waves, so a cheater can keep playing for weeks before Facepunch pushes a batch of accounts off Steam at once. EAC sits inside the running game, watches your PC's memory and loaded modules, and feeds detections into a queue instead of acting on them in real time.
In 2026 Facepunch rolled out what it called an invasive upgrade to EAC. The module now scans more of the machine than it used to, and the company's own COO has said he expects the stricter checks to become mandatory. Every card on the Rust hub carries a status badge that moves the moment a wave hits a build, so you can see when a cheat goes from undetected to updating without having to log in and find out the hard way.
Below is what EAC actually watches during a session, why bans are held back for the wave, which cheat types the anti-cheat sees fastest and which it takes longest to catch, and what the Facepunch retrospective numbers really say about the odds.
Words used in this article
EAC is short for Easy Anti-Cheat. It's a kernel-level anti-cheat module that loads with the game, reads what's running on your PC and reports findings back to Facepunch's servers. Rust requires it to join any official server.
Ban wave is a scheduled batch of account bans released at once. Facepunch holds EAC detections and applies them in a wave each month, instead of banning accounts the second they're flagged.
HWID ban stands for hardware ID ban. On top of blocking the Steam account, EAC can mark the fingerprint of the hardware (motherboard, drives, network card) so a fresh account on the same PC gets blocked too.
Overlay cheat draws ESP or triggers over the top of the game without touching the game's own memory. The overlay runs as its own window and reads data from a separate source, which gives EAC less to find inside the game process.
Report thresholding is how the reporting system decides who to look at. Players flag suspicious kills in-game, and accounts crossing a threshold of credible reports move up the queue for the next wave.
How EAC watches a Rust session
The anti-cheat module loads with Rust and runs at a privileged level for the whole session. Its job is to collect enough signal about what is happening on the machine to decide whether something is interfering with the game.
Its checks fall into four groups:
- Memory scans. EAC sweeps the Rust process's own memory and the memory of nearby processes, looking for signatures of known cheats and for patterns that only make sense if someone is reading or writing game state from outside.
- Loaded module signatures. Every DLL that gets loaded into the game is hashed and checked against known-bad lists. A public injected DLL that has been seen before gets picked up on the first session.
- Driver and kernel fingerprints. EAC enumerates loaded drivers and kernel objects on the system. Suspicious drivers, including spoofed vendor names and unsigned entries, feed into the detection signal.
- Behavioural telemetry. Facepunch has publicly said EAC has been adding more effort against scripting, which means watching input and camera movement for patterns that match recoil-control macros.
The 2026 upgrade PC Gamer wrote about is why that fourth bullet matters now. Facepunch described the new build as more invasive on purpose. The module reads deeper into the PC than it used to, and part of the player base has pushed back on how much the anti-cheat touches. Facepunch's position is that it works, and the COO has said the stricter mode is likely to stay.
Why detections are held for the wave
Facepunch doesn't act on every detection the moment it fires. A flagged account goes into a queue, and the accumulated bans are released in a wave once a month. This design is the single biggest reason Rust cheating looks the way it does in 2026.
The trade-off is deliberate. If the system banned the second it flagged something, two problems get worse. Cheat sellers would learn within an hour exactly what tripped the detection, because the banned account is the signal itself. Any false positives would also hit players one by one with no human review in between.
Batching works the other way round. Thousands of accounts move at once, cheat sellers can't tell which of a dozen recent changes was the one EAC caught, and the review window gives Facepunch time to toss out matches that look like false positives before they reach a player's profile.
The scale of the system is on the record. Facepunch's 12-year retrospective puts the running total at over 42,000 temporary bans applied and over 16 million cheat reports received. Those two numbers say two things worth reading plainly: EAC is taking action in bulk, and player reports are the raw material each wave gets built from. If you are reported often and your profile pattern lines up with what EAC's scans flagged, the next wave is where you land.
Which cheat types EAC sees quickly
Not every cheat is equal in front of EAC. The rough ranking across 2026, from fastest flagged to slowest, looks like this.
- Public injectors and well-known DLLs. These are the quickest to flag. A DLL that has been in circulation for a while has a hash on the known-bad list, and an injector that uses a documented technique gets caught the same way. These show up in the next wave at the latest, and often inside days of the current cycle starting.
- Recoil scripts and input macros. Scripting sits in the middle. Facepunch has been adding specific effort against recoil-control and input-macro behaviour, so the detection surface here has been growing. A clean script that behaves like a steady human still slips through, but the margin has shrunk.
- Private internal cheats with fresh code. Internals with their own loader and fresh signatures take longer. They still touch game memory, so they're in range of EAC's memory scans, but the known-bad lists don't know them yet. A vendor who updates after each monthly Facepunch patch is what keeps this type alive.
- Overlay cheats and second-PC setups. Slowest of the four. An overlay that draws from outside the game process has less for EAC to find, and DMA Rust cheats read the game's RAM from a separate card on a second PC, so EAC does not see that reader at all.
For a side-by-side on all of these categories, there's a separate post on external and internal Rust cheats and how they compare with DMA.
What this means if you're buying
The practical takeaway is that the status badge on each product card is the signal worth watching. Every card on the catalogue carries one, and it moves when a wave hits.
- Check the status badge before you buy. An undetected badge means the current build hasn't been caught in the last wave. If the card says updating, the vendor is pushing a fix and you'll want to wait for it to flip back.
- Favour builds whose devs ship fixes after each force wipe. Rust's first-Thursday-of-the-month force wipe is when fix windows cluster, because the monthly Facepunch update ships that day and the cheats have to catch up with it in the same window.
- For the slowest-to-detect option, DMA is where to look. NIGHTFALL DMA and EVERWARE DMA both carry the undetected badge today, both read Rust's memory from a second PC with their own DMA card and EAC firmware, and EAC does not see the second machine at all.
- For a feature-rich internal on the same PC, look at MASON. It runs alongside the game, so it sits in range of EAC's memory scans, which is why its status badge matters more day to day than a DMA card's does.
Those four checks make it easy to read Rust cheats on Camelot at a glance: the status badge for right now, the vendor's track record across recent waves, and the cheat type itself. Together they tell you how long a build tends to stay up and how much warning you get when it stops.
EAC's wave model is the frame for all of this. A cheat's status badge is there because Facepunch batches, not because every detection fires in real time. Watch the badges across each monthly cycle, keep an eye on the force-wipe Thursday, and the Rust builds we list stay a reliable read on what's working right now and what to leave alone.
